GhostBat RAT Captures Fintech Credentials via Spoofed Indian Traffic Challan SMS
Android users in India face credential theft as GhostBat RAT uses fake traffic fines to install malware that steals PINs from dozens of financial apps.
Key points
- GhostBat RAT now captures PINs from 60 banking and fintech applications in India.
- Attackers use SMS phishing with fake traffic challan links to deliver the malware.
- The malware employs loader techniques to hide payloads from initial security scans.
The GhostBat remote access trojan grants attackers direct access to sensitive financial credentials on Android devices. To achieve this, threat actors convince users to install malicious applications disguised as official government traffic services. This access allows the malware to capture personal identification numbers from a wide range of banking and digital wallet applications, compromising user accounts and financial data.
How it unfolded
- Cybersecurity firm Cyble first identified the GhostBat malware strain in October 2025.
- The malware evolved to specifically target users through SMS messages about unpaid traffic fines.
- Operators linked phishing pages and backend systems into a broader ecosystem known as GhostX.
Who is affected
Android users in India are the primary targets of this campaign. The attackers focus on individuals who receive text messages claiming they owe traffic violations. These messages contain links to fraudulent websites that impersonate the official Parivahan service or Google Play Store. Users who download the resulting application expose their devices to the malware.
The fix
No confirmed patch or update has been released to address this specific malware variant. Security teams should monitor for unauthorized application installations on managed Android devices. Administrators should verify that users are not installing APK files from unverified sources. Until a vendor provides a specific remediation, users should rely on standard mobile security controls.
What made it possible
This incident relies on social engineering to bypass technical defenses. The weakness lies in user trust for urgent government communications. Attackers exploit the expectation that traffic fines require immediate attention. This technique serves the initial access stage of an intrusion. Teams usually see success when victims download files outside official app stores. Check whether users are prompted to enable installation from unknown sources during the attack.
What to do and how to stay safe: GhostBat RAT
- Verify the authenticity of any SMS claiming a traffic violation before clicking links.
- Ensure Android devices are set to only install applications from verified app stores.
- Monitor mobile devices for unfamiliar applications that request accessibility or notification permissions.
- Educate users to recognize phishing attempts that create a sense of urgency or fear.
Step-by-step guide: Offline Backups: Real Protection Against Ransomware and Data Loss
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many applications does GhostBat RAT target?
It captures PINs from 60 banking, UPI, wallet, and fintech applications.
How does the malware reach victims?
It spreads through SMS phishing messages with links to fake traffic challan pages.
Is there a fix available for GhostBat RAT?
No confirmed patch or update has been released for this malware.
